elastic / elastic/integrations

Elastic Agent Azure Logs Integration missing related.users

Open
#9,145 5 comments 0 reactions 1 assignee Claimed by @zmoog View on GitHub
bug Integration:azure Stalled Team:Cloud-Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

Hello,

Just migrated from Filebeat azure module to Elastic Agent Azure Logs integration and I noticed some issues.

1) There seems to be no `related.users` field for the signin logs. THis is unfortunate, as this field is very usable to correlate data.

2) The user.name filed is populated correctly for the `SignInLogs `but not for the `ServicePrincipalSignInLogs`. The field containing the `ServicePrincipalSignInUser` is `azure.signinlogs.properties.service_principal_name`. The value of this field should be copied to `user.name` and to `related.users`

An example sanitized log:
```
{
"_index": ".ds-logs-azure.signinlogs-default-2024.02.13-000001",
"_id": "ojMQo40BDs_HQWCsjO44",
"_version": 1,
"_score": 0,
"_ignored": [
"event.original"
],
"_source": {
"agent": {
"name": "myagentnode",
"id": "",
"ephemeral_id": "",
"type": "filebeat",
"version": "8.11.4"
},
"log": {
"level": "4"
},
"elastic_agent": {
"id": "",
"version": "8.11.4",
"snapshot": false
},
"azure-eventhub": {
"sequence_number": 39194,
"consumer_group": "$Default",
"offset": 17183841952,
"eventhub": "signinlogs",
"enqueued_time": "2024-02-13T14:45:47.225Z"
},
"tags": [
"preserve_original_event",
"azure-signinlogs",
"forwarded"
],
"cloud": {
"provider": "azure"
},
"input": {
"type": "azure-eventhub"
},
"@timestamp": "2024-02-13T14:44:04.060Z",
"ecs": {
"version": "8.0.0"
},
"related": {
"ip": [
"33.44.55.66"
]
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "azure.signinlogs"
},
"client": {
"ip": "33.44.55.66"
},
"event": {
"duration": 0,
"agent_id_status": "verified",
"ingested": "2024-02-13T15:23:07Z",
"kind": "event",
"action": "Sign-in activity",
"id": "event-id",
"category": [
"authentication"
],
"type": [
"info"
],
"dataset": "azure.signinlogs",
"outcome": "success"
},
"azure": {
"tenant_id": "tenant-id",
"signinlogs": {
"result_type": "0",
"operation_version": "1.0",
"caller_ip_address": "33.44.55.66",
"result_signature": "None",
"operation_name": "Sign-in activity",
"category": "ServicePrincipalSignInLogs",
"properties": {
"risk_level_aggregated": "low",
"is_tenant_restricted": false,
"applied_conditional_access_policies": [],
"created_at": "2024-02-13T14:42:31.738821+00:00",
"risk_level_during_signin": "low",
"authentication_protocol": "none",
"sign_in_token_protection_status": "none",
"resource_service_principal_id": "princip-id",
"token_issuer_type": "AzureAD",
"conditional_access_status": "notApplied",
"id": "event-id",
"client_credential_type": "none",
"app_id": "app-id",
"service_principal_credential_key_id": "cred-id",
"is_interactive": false,
"service_principal_id": "princip-id",
"flagged_for_review": false,
"authentication_processing_details": {
"Azure AD App Authentication Library": "Family: MSAL Library: MSAL.NET 4.8.2.0 Platform: .NET FW"
},
"risk_detail": "none",
"resource_display_name": "Microsoft Graph",
"risk_state": "none",
"incoming_token_type": "none",
"cross_tenant_access_type": "none",
"original_transfer_method": "none",
"processing_time_ms": 0,
"resource_id": "00000003-0000-0000-c000-000000000000",
"app_service_principal_id": null,
"correlation_id": "co-id",
"service_principal_name": "MyServicePrincipalUser",
"unique_token_identifier": "un-token",
"status": {
"error_code": 0
}
}
},
"resource": {
"provider": "Microsoft.aadiam",
"id": "/tenants/tenant-id/providers/Microsoft.aadiam"
},
"correlation_id": "co-id"
}
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.